This vulnerability in Sparx Systems Pro Cloud Server arises from incorrect authorization controls during communication with the database. Specifically, low privileged users can bypass permission checks and run arbitrary SQL queries, potentially leading to unauthorized data access or manipulation. The issue has been confirmed in version 6.1 (build 167) and earlier, but other versions have not been tested. The vendor has not responded with detailed information or a fix, and no official remediation is currently available.

An attacker with low privileges can execute arbitrary SQL queries on the database, which may lead to unauthorized data access, modification, or other impacts depending on the database context. The CVSS 4.0 score of 8.7 reflects high impact due to network attack vector, low attack complexity, no privileges required, and high impact on confidentiality and integrity. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been provided by Sparx Systems, users should monitor vendor communications closely. Until a patch is available, restrict access to the Pro Cloud Server to trusted users only and consider additional network-level controls to limit exposure.